# Running n-OS-tr ISO (Manual-Start Baseline)

This ISO now boots to a plain Debian login prompt.

No n-OS-tr services auto-start at boot. This is intentional for deterministic troubleshooting.

## Boot posture

At boot, these units are **disabled** by default:

- `n-os-tr-firstboot.service`
- `nostr-id.service`
- `nostr-id-tui.service`
- `nostr-id-tui-services.service`
- `didactyl.service`
- `c-relay.service`
- `ginxsom.service`
- `fips.service`
- `fips-dns.service`
- `nginx.service`
- `nostr-config-loader.service`
- `nostr-config-writer.service`
- `ssh.service`
- `tor.service`

Default Debian getty/login remains on tty1/tty2/tty3+.

## Virtual terminals

Use Linux VT hotkeys:

- `Ctrl+Alt+F1` → tty1
- `Ctrl+Alt+F2` → tty2
- `Ctrl+Alt+F3` → tty3
- `Ctrl+Alt+F4..F6` → additional shells

## Recommended bring-up flow (which terminal to use)

Use **one control shell** for commands: **tty3** (recommended).

- tty1: run `n_signer` directly in foreground
- tty2: optional service-menu UI (if started)
- tty3: your command shell for setup/service commands

### Step-by-step

1) Log in on **tty3 only** (`Ctrl+Alt+F3`).

2) On tty3, run first-boot provisioning:

```bash
sudo systemctl start n-os-tr-firstboot.service
```

3) Switch to **tty1** (`Ctrl+Alt+F1`) and start signer directly:

```bash
sudo /usr/local/bin/n_signer \
  --socket n_os_tr \
  --preapprove caller=uid:0,nostr_index=0 \
  --preapprove caller=uid:0,nostr_index=1 \
  --preapprove caller=uid:0,nostr_index=2 \
  --preapprove caller=uid:0,nostr_index=3 \
  --preapprove caller=uid:0,nostr_index=5
```

4) Keep signer running on tty1, then switch back to **tty3** (`Ctrl+Alt+F3`).

5) Optional service start commands are run from **tty3** (not separate terminals required):

```bash
sudo systemctl start nginx.service
sudo systemctl start ginxsom.service
sudo systemctl start c-relay.service
sudo systemctl start fips.service
```

## Status and logs

Check core/optional service states:

```bash
systemctl --no-pager --full status n-os-tr-firstboot.service nginx.service ginxsom.service c-relay.service fips.service
```

Tail unit logs:

```bash
pgrep -a n_signer
journalctl -fu nginx.service
```

Or standard journalctl:

```bash
journalctl -u n-os-tr-firstboot.service
journalctl -u nostr-id-tui-services.service
journalctl -u nginx.service
```

## Endpoints (when services are started)

- Landing page: `https://localhost/`
- Relay websocket: `wss://localhost/relay`
- Relay admin/API: `https://localhost/admin/`

## Smoke test

Run:

```bash
n-os-tr-smoketest
```

No-color output:

```bash
NO_COLOR=1 n-os-tr-smoketest
```

## Notes

- Identity remains ephemeral by default unless explicitly persisted.
- Manual-start mode is intended to isolate failures stage-by-stage.